kevent: Disallow certain filter types in capability mode

[markj]

Summary

EVFILT_PROC, EVFILT_JAIL and EVFILT_FS knotes let a process collect
information about objects without requiring a capability. They
shouldn't be allowed when the process is in capability mode, so add
checks to this effect.

Note, this does nothing about knotes that are registered already at the
time cap_enter() is called, but I think this is acceptable.

[arrowd]

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Same for EVFILT_JAIL.

[markj]

In D58397#1339692, @arrowd wrote:

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Yes, there is some precedent for that. For instance, raise() is supposed to work in capability mode.

Same for EVFILT_JAIL.

Why? The current process doesn't own its containing jail in any sense.

[kib]

In D58397#1339713, @markj wrote:

In D58397#1339692, @arrowd wrote:

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Yes, there is some precedent for that. For instance, raise() is supposed to work in capability mode.

But then what to do with NOTE_TRACK, without which EVFILT_PROC is useless. Esp. it is useless on itself.

sys/kern/kern_event.c

457

If we do not need much flexibility, it might be better to add a flag to filterops which would deny attach if in_cap_mode() && flag && !f_isfd.

[arrowd]

In D58397#1339713, @markj wrote:

Same for EVFILT_JAIL.

Why? The current process doesn't own its containing jail in any sense.

Yes, you're correct, don't mind me.

[markj]

In D58397#1339785, @kib wrote:

In D58397#1339713, @markj wrote:

In D58397#1339692, @arrowd wrote:

This would prevent a process from tracking itself using EVFILT_PROC. Not sure how useful it is, but maybe it makes sense to add an exception for ident == getpid().

Yes, there is some precedent for that. For instance, raise() is supposed to work in capability mode.

But then what to do with NOTE_TRACK, without which EVFILT_PROC is useless. Esp. it is useless on itself.

Yeah, it does not seem very useful. Without some use-case I am inclined to disallow all uses of EVFILT_PROC in capmode.

sys/kern/kern_event.c

457

If anything I would invert such a flag, so !f_isfd filters are disallowed in capmode unless they set the flag.

[kib]

sys/kern/kern_event.c

457

Sure., Technically, I think that f_isfd should become a flag word instead of bool.